The use of electronic communications, such as email, instant messaging, web pages, SMS and voice over IP, and computer files, such as presentations, spreadsheets and documents, for business purposes have become prevalent in today's business world. Over the years, as electronic communications and computer files have supplanted the use of paper documents, it has become more and more important to find a way to archive copies of electronic data files.
There are many reasons why business communications and documents in general need to be archived in searchable WORM storage. Many government regulations, such as Sarbanes Oxley, HIPAA, Patriot Act, GLB and SEC, require that business communications be archived for a number of years. Evidentiary discovery rules require the production of business communications pertinent to the issues in a case. And corporate governance and disaster recovery requires the archival of important business communications and documents in case the originals are destroyed.
In the past, the archival of business communications was limited to storing corporate reports and accounting books to an off-site warehouse. As email came into wide usage, the archival of emails became a regulatory requirement, but this was mostly limited to financial institutions. In the last five years, due to the increased prevalence of electronic communications and the increase in government regulations resulting from several accounting scandals, nearly all companies are required to archival some amount of email, instant messages, business reports and accounting spreadsheets.
Currently, most companies meet government regulatory and corporate governance requirements by archiving copies of corporate document files and email backups to optical WORM storage, such as optical tape or CD-R discs, and storing the optical WORM storage at a third party vendor's location. There are several drawbacks to this approach. The optical WORM storage archives are not readily available. It is difficult to find specific archived documents among a set of optical WORM storage, since there is no consolidated index, requiring each optical disc or tape to be retrieved, loaded and searched. To find a specific email can require a large effort, since backups normally occur on a daily or weekly basis and each backup needs to be restored to an email server before it can be searched.
Another drawback to the “copy everything to optical WORM storage” is the inability to delete documents and emails after their retention period has lapsed. Information stored in these archives could potentially be used against a company in the event of a lawsuit, so it is important to delete the archived material as soon as government regulatory and corporate governance retention requirements are met. While an optical WORM storage media can be physically destroyed at the end of the retention period, a manual process must be in place to implement this. Plus, since an individual file cannot be deleted on the optical WORM storage media, the entire disc or tape must be retained until the retention period of every electronic data file has passed, forcing files to be saved that could have been deleted.
Finally, the electronic data files on the optical WORM storage media are typically not encrypted. This allows anyone with access to the optical WORM storage media and an optical WORM storage reader to potentially view confidential corporate information.
Several products have been created to address these issues. They seek to implement WORM storage on regular hard disk drives. The two main storage products are EMC's Centera, which uses Content Addressable Storage (CAS) and Network Appliance's Netstore, which uses SnapLock. Both prevent file deletion by using a custom operating system. Both also employ a custom proprietary filesystem, which means their hard drives are unreadable in general purpose operating systems.
The drawback to these storage products is they were created for general purpose network storage, abet with WORM characteristics. Since third-party user applications access via NFS or SAN, the products need to provide a full set of filesystem operations. The underlying hard disk data is not completely encrypted. And there is no automatic deletion mechanism when electronic data files reach the end of their retention period.